ID. Date of interview 
date 94/91/20 


ID. Time interview started 
start 19:33:21 


ID.end Completion date of interview 
Date 94/01/20 


ID.end Time interview ended 
11:05:07 


ID. Duration of interview 
time 34.77 


Start of new case 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
Yes 
No 


© Unsure / don't know 
If no or unsure/don’t know, what other issues would you like to be covered in it? 


Would like to see tighter guidance on definition of "reasonable searches". What constitutes malicious, 
manifestly unfounded, excessive or unreasonable use of the right of access? Guidance on what to do 
with requests that require non-specific email searches and result in thousands of results. Currently having 
to manually check these. No software can tell one from another without manual intervention. 
Volume seems to be played down in the guidance in favour of complexity. If we have to read through and 
redact hundreds of pages, the guidance could be more sympathetic to volume as a factor in extending 
past the calendar month. 


Q2 


Does the draft guidance contain the right level of detail? 
O) Yes 

©) No 

© Unsure / don't know 


If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Page12 - there are 2 types of Power of Attorney - guidance mentions one, but not the other. It's not clear 
whether one or both could be accepted for use on behalf of an individual. Page15 - can ICO elaborate on 
what requests could be processed under BAU rather than as SARs? Examples? Would like to see tighter 
guidance on definition of "reasonable searches". What constitutes malicious, manifestly unfounded, 
excessive or unreasonable use of the right of access? 


Q3 


Does the draft guidance contain enough examples? 
C) Yes 
Æ) No 
©) Unsure / don't know 


If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


Links to relevant ICO case decisions from within the guidance document would make it easier to keep up 
with events and would perhaps minimise the need for fictional examples. For example, is it possible to tag 


a case decision document with relevant keywords and for a link per keyword be available at the relevant 
point in the document? 


Q4 We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 


unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 


from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 


requests below (if applicable). 


Volume plays a large part, and the requester's unwillingness to specify what they do 
want. We can't ask them to limit their request. We have in the past had to process 
additional requests to the original where we know there is no further information. 


Q5 Ona scale of 1-5 how useful is the draft guidance? 


1-Notatall 2-—Slightly Moderately 4-Very 5- Extremely 
useful useful useful useful useful 


© 


Q6 Why have you given this score? 


some of the guidance has been tightened up, but a lot of it is still general and could 
be read in different ways. 


Q7 To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


© 


Q8 


Q9 


Q10 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


P16 - “Calendar Month” with no acceptance of public holidays allows significantly 
fewer days for some requests than others, just specifically due to the date they 
came to us. For example, receipt at the start of October would allow for 31 days 
without any public holidays, but receipt in December would be 3 days shorter. In 
some cases, these public holidays have been the difference between compliance and 
not. Why aren’t public holidays taken into account? Wouldn’t just making it 20 
working days and factoring in public holidays be easier and bring it into line with 
FOI? P55 - it would be good to get some specific guidance on personal information 
contained in routine weekly/ monthly management update reports that don’t focus 
on the individual and containing many dozens/hundreds of other people’s data. It's 
personal data with very little value to the requester. 


Are you answering as: 

C) An individual acting in a private capacity (eg someone providing their views as a member of the public) 
(`) An individual acting in a professional capacity 

© On behalf of an organisation 

C) Other 

Please specify the name of your organisation: 

denbighshire county council 


What sector are you from: 
local authority 


How did you find out about this survey? 
©) ICO Twitter account 
_) ICO Facebook account 
(`) ICO LinkedIn account 
(`) ICO website 
( `) ICO newsletter 
(_) ICO staff member 
(`) Colleague 
( ) Personal/work Twitter account 
( ) Personal/work Facebook account 
|) Personal/work LinkedIn account 
( ) Other 
If other please specify: 


